Technical Information
To ensure autorun and distribution
Modifies the following registry keys
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'MykgroundApp' = '%WINDIR%\sovfr\vbswl.vbs'
Sets the following service settings
- [HKLM\SYSTEM\CurrentControlSet\Services\WinRing0_1_2_0] 'ImagePath' = '%WINDIR%\sovfr\WinRing0x64.sys'
Creates the following services
- 'WinRing0_1_2_0' %WINDIR%\sovfr\WinRing0x64.sys
Modifies file system
Creates the following files
- %WINDIR%\sovfr\config.json
- %WINDIR%\sovfr\scvhsot.exe
- %WINDIR%\sovfr\vbswl.vbs
- %WINDIR%\sovfr\app.bat
Sets the 'hidden' attribute to the following files
- %WINDIR%\sovfr\config.json
- %WINDIR%\sovfr\scvhsot.exe
- %WINDIR%\sovfr\vbswl.vbs
- %WINDIR%\sovfr\app.bat
Network activity
Connects to
- 'au##.c3pool.org':80
TCP
Other
- 'au##.c3pool.org':80
UDP
- DNS ASK au##.c3pool.org
Miscellaneous
Searches for the following windows
- ClassName: 'EDIT' WindowName: ''
Creates and executes the following
- '<SYSTEM32>\wscript.exe' "%WINDIR%\sovfr\vbswl.vbs"
- '%WINDIR%\sovfr\scvhsot.exe'
Executes the following
- '<SYSTEM32>\cmd.exe' /c ""%WINDIR%\sovfr\App.bat" "
- '%WINDIR%\sovfr\scvhsot.exe' ' (with hidden window)
